0.9.5

The 0.9.5 release expands the MCP Server from file and folder handling into secure
mail, sharing and Kiteworks administration, adopts the latest MCP specification, and
adds a layer of controls designed for a world where the calling agent cannot be
trusted by default.

New tools

• Secure Mail — read, list and compose Kiteworks email, with mailbox counters and policy pre-validation before sending
• Folder and file sharing — list members and add, update or remove them
• File copy — copy files between folders
• User administration — create and update users, reset TOTP enrollment, and read user metadata
• User profile administration — create, assign and bulk-assign profiles, with mapping eligibility checks
• Shared mailbox administration — create, delete and manage members
• Risk policies — read risk policies
• Admin activity logs — search admin activity with date range and event filtering

Security: containing a rogue or compromised agent

The controls below assume the model, and the client it runs in, may be adversarial or
manipulated by injected content.

• Human confirmation on destructive operations. Deleting files and folders, sending
  mail, changing members, deleting shared mailboxes, bulk profile assignment, TOTP
  resets, user creation and policy and tag writes all require an explicit human answer,
  over any transport. Eleven admin and policy write tools were brought under the gate in
  this release.
• Confirmation cannot be forged or replayed. Tokens are signed with a dedicated key
  (never the session secret), bound to the tool, the arguments and the user they were
  issued to, and expire quickly. A token issued for one call, one tool or one user will
  not authorize another.
• Prompt-injection resistance in confirmations. Object names shown in a confirmation
  are quoted, neutralized and truncated, so a file or folder named to look like an
  instruction cannot rewrite the question the human is answering.
• Filesystem containment. Local file access is confined to an explicit
  approved-directory allowlist (--allow-dir). An empty value fails closed rather than
  opening the filesystem, every spelling of a UNC path is refused, and the
  previous implicit default has been removed.
• Least privilege by scope. tools/list advertises only what the authenticated
  user's OAuth scopes permit, so an agent is never shown a capability it cannot use.
  The /security/* scope was split into separate risk-policy and security-tag families.
• Credentials are not left on disk. STDIO mode uses ephemeral tokens by default;
  persistence is opt-in with --persist-token.
• Rate limiting hardened. Limiters no longer fail open, use correct per-method keys,
  re-key the session tier on the OAuth client, meter requests before authentication, and
  meter server/discover.
• Signed artifacts. Container images are cosign-signed, verified in the pipeline, and
  copied to GHCR with the signature intact and the digest preserved. macOS binaries and
  installers are code-signed and notarized; Windows binaries are signed.
• Risk-policy write operations remain gated behind an internal flag with no way to enable
  them in a production build.

MCP protocol specification 2026-07-28

• Full conformance with MCP specification 2026-07-28
• Multi round-trip requests replace the older elicitation flows, so a server can ask
  the calling client a question mid-tool-call and continue with the answer
• Clients on older protocol versions remain supported: where they cannot be prompted,
  a signed confirmation token carries the same guarantee across two calls
• MCP client identity is resolved per request, logged once per connected client, and
  carried into the User-Agent of every outbound Kiteworks request, so activity is
  attributable to a specific AI client rather than to "the MCP server"
• Mcp-Method and Mcp-Name request headers are logged as structured fields
• The deprecated HTTP+SSE transport is dated and announced for removal; Streamable
  HTTP is the supported remote transport
• CORS preflight accepts the request headers the new specification introduces

Compatibility

This release requires Kiteworks 9.5 or later. MCP is disabled by default; a Kiteworks
administrator enables it under Application Setup → Clients and Plugins → MCP.

Docker container: ghcr.io/kiteworks/kiteworks-mcp:0.9.5